forgexa-cli 1.31.1__tar.gz → 1.31.2__tar.gz

{forgexa_cli-1.31.1 → forgexa_cli-1.31.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forgexa-cli
-Version: 1.31.1
+Version: 1.31.2
 Summary: Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform
 Author-email: Jason Sun <dev.winds@gmail.com>
 License-Expression: MIT

{forgexa_cli-1.31.1 → forgexa_cli-1.31.2}/forgexa_cli/__init__.py

@@ -1,2 +1,2 @@
 """forgexa-cli — Forgexa command-line client."""
-__version__ = "1.31.1"
+__version__ = "1.31.2"

{forgexa_cli-1.31.1 → forgexa_cli-1.31.2}/forgexa_cli/daemon.py

@@ -910,7 +910,7 @@ except (ImportError, ModuleNotFoundError):
 # DAEMON_VERSION is the protocol/logic version of the daemon code.
 # Kept in sync with pyproject.toml version via bump-version.sh.
 # CLIENT_TYPE identifies which packaging/distribution this daemon runs in.
-DAEMON_VERSION = "1.31.1"
+DAEMON_VERSION = "1.31.2"
 
 
 def _detect_client_type() -> str:
@@ -7101,6 +7101,10 @@ class ServerConnection:
         self.client = httpx.AsyncClient(
             headers={"Authorization": f"Bearer {api_token}"} if api_token else {},
             verify=_make_httpx_ssl_context(),
+            # Never go through an ambient system/env proxy: server_url is always an
+            # operator-specified Forgexa server, and macOS's proxy bypass list isn't
+            # honored here, which otherwise turns loopback calls into 502s.
+            trust_env=False,
         )
         self.heartbeat: HeartbeatService | None = None
         self.poller: TaskPoller | None = None

{forgexa_cli-1.31.1 → forgexa_cli-1.31.2}/forgexa_cli/main.py

@@ -611,7 +611,12 @@ def _revoke_server_session(refresh_token: str) -> bool:
 
     url = f"{_api_url()}/api/v1/auth/logout"
     try:
-        with httpx.Client(timeout=10) as client:
+        # trust_env=False on every Forgexa-server client: httpx picks up the
+        # macOS system proxy (scutil) via urllib getproxies() without honoring
+        # the OS bypass list, routing loopback server calls through the proxy
+        # into 502s (same root cause as the daemon fix, 2026-08-28). Public
+        # internet calls (e.g. the PyPI update check) keep default behavior.
+        with httpx.Client(timeout=10, trust_env=False) as client:
             resp = client.post(url, json={"refresh_token": refresh_token})
             resp.raise_for_status()
     except Exception:
@@ -625,7 +630,7 @@ def _submit_refresh_token(refresh_token: str) -> bool:
 
     url = f"{_api_url()}/api/v1/auth/refresh"
     try:
-        with httpx.Client(timeout=15) as client:
+        with httpx.Client(timeout=15, trust_env=False) as client:
             resp = client.post(url, json={"refresh_token": refresh_token})
             resp.raise_for_status()
             payload = resp.json()
@@ -1606,7 +1611,7 @@ def _request_json(
 
     url = f"{_api_url()}/api/v1{path}"
     try:
-        with httpx.Client(headers=_headers(), timeout=timeout) as client:
+        with httpx.Client(headers=_headers(), timeout=timeout, trust_env=False) as client:
             resp = client.request(method, url, json=data)
             # Let callers (e.g. login) inspect the live client — notably its
             # cookie jar — before it is discarded.
@@ -1870,11 +1875,11 @@ def _get_runtimes_silent(include_all: bool = False) -> list[dict]:
     path = "/runtimes" if include_all else "/runtimes/me"
     url = f"{_api_url()}/api/v1{path}"
     try:
-        with httpx.Client(headers=_headers(), timeout=10) as client:
+        with httpx.Client(headers=_headers(), timeout=10, trust_env=False) as client:
             resp = client.get(url)
             if resp.status_code == 401 and _refresh_access_token():
                 # Retry once with the new token
-                with httpx.Client(headers=_headers(), timeout=10) as retry_client:
+                with httpx.Client(headers=_headers(), timeout=10, trust_env=False) as retry_client:
                     resp = retry_client.get(url)
             resp.raise_for_status()
             result = resp.json() if resp.content else []
@@ -2392,10 +2397,10 @@ def _delete_authenticated(path: str) -> tuple[int, dict]:
 
     url = f"{_api_url()}/api/v1{path}"
     try:
-        with httpx.Client(headers=_headers(), timeout=30) as client:
+        with httpx.Client(headers=_headers(), timeout=30, trust_env=False) as client:
             resp = client.delete(url)
             if resp.status_code == 401 and _refresh_access_token():
-                with httpx.Client(headers=_headers(), timeout=30) as retry_client:
+                with httpx.Client(headers=_headers(), timeout=30, trust_env=False) as retry_client:
                     resp = retry_client.delete(url)
     except httpx.RequestError as e:
         print(f"Connection error: {e}\nServer: {_api_url()}", file=sys.stderr)
@@ -2453,10 +2458,10 @@ def _post_authenticated(path: str, data: dict | None) -> tuple[int, dict]:
 
     url = f"{_api_url()}/api/v1{path}"
     try:
-        with httpx.Client(headers=_headers(), timeout=30) as client:
+        with httpx.Client(headers=_headers(), timeout=30, trust_env=False) as client:
             resp = client.post(url, json=data or {})
             if resp.status_code == 401 and _refresh_access_token():
-                with httpx.Client(headers=_headers(), timeout=30) as retry_client:
+                with httpx.Client(headers=_headers(), timeout=30, trust_env=False) as retry_client:
                     resp = retry_client.post(url, json=data or {})
     except httpx.RequestError as e:
         print(f"Connection error: {e}\nServer: {_api_url()}", file=sys.stderr)

{forgexa_cli-1.31.1 → forgexa_cli-1.31.2}/forgexa_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forgexa-cli
-Version: 1.31.1
+Version: 1.31.2
 Summary: Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform
 Author-email: Jason Sun <dev.winds@gmail.com>
 License-Expression: MIT

{forgexa_cli-1.31.1 → forgexa_cli-1.31.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "forgexa-cli"
-version = "1.31.1"
+version = "1.31.2"
 description = "Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform"
 requires-python = ">=3.9"
 license = "MIT"

{forgexa_cli-1.31.1 → forgexa_cli-1.31.2}/tests/test_auth_and_runtime_commands.py

@@ -1527,3 +1527,31 @@ async def test_daemon_submit_refresh_network_error_without_new_pair(
         assert creds[_ISSUER]["refresh_token"] == "refresh-old"
     finally:
         await conn.client.aclose()
+
+
+def test_server_api_clients_disable_ambient_proxy(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+    """Regression (2026-08-28, same root cause as the daemon 502 fix): every
+    Forgexa-server httpx client in main.py must set trust_env=False — on macOS
+    httpx otherwise picks up the scutil system proxy via urllib getproxies()
+    without honoring the OS bypass list, and calls to a loopback server come
+    back as proxy-generated 502s. Driven through the generic _request_json
+    helper and the auth refresh path, with the server pointed at an unbound
+    loopback port so no real traffic leaves the machine."""
+    monkeypatch.setenv("HOME", str(tmp_path))
+    monkeypatch.setattr(main, "_SERVER_URL_OVERRIDE", "http://127.0.0.1:9")
+
+    captured: list[dict] = []
+    real_client = httpx.Client
+
+    def spy_client(*args, **kwargs):
+        captured.append(kwargs)
+        return real_client(*args, **kwargs)
+
+    monkeypatch.setattr(httpx, "Client", spy_client)
+
+    with contextlib.suppress(SystemExit):
+        main._request_json("/runtimes/me")  # connection error → sys.exit(3)
+    assert main._submit_refresh_token("refresh-token") is False
+
+    assert captured, "expected at least one httpx.Client construction"
+    assert all(kwargs.get("trust_env") is False for kwargs in captured)

{forgexa_cli-1.31.1 → forgexa_cli-1.31.2}/tests/test_expiry_warnings_and_revoke.py

@@ -384,3 +384,21 @@ def test_daemon_silent_when_credential_valid_beyond_7_days(
         import asyncio
 
         asyncio.run(conn.client.aclose())
+
+
+def test_server_connection_client_disables_ambient_proxy(monkeypatch: pytest.MonkeyPatch):
+    """Same regression as backend test_runtimes: the daemon's server client must
+    never ride an ambient system/env proxy — on macOS a scutil system proxy is
+    picked up by httpx (trust_env=True) without honoring the bypass list, and
+    loopback registration calls come back as 502s until the daemon exits."""
+    captured_kwargs: dict = {}
+    real_async_client = daemon.httpx.AsyncClient
+
+    def capture_init(*args, **kwargs):
+        captured_kwargs.update(kwargs)
+        return real_async_client(*args, **kwargs)
+
+    monkeypatch.setattr(daemon.httpx, "AsyncClient", capture_init)
+    daemon.ServerConnection(_ISSUER, "frt_secret_value", "daemon-1")
+
+    assert captured_kwargs.get("trust_env") is False